CVE-2026-71416

Headroom, an open-source proxy that compresses data before it is sent to a large language model, did not validate the `Origin` header of incoming WebSocket client connections before forwarding requests to the upstream server in versions prior to 0.35.0 (CWE-287, CWE-1385). A malicious WebSocket client running in a browser, including headless browsers such as lightpanda, that can reach the Headroom proxy can issue arbitrary LLM requests without authentication, for example via scripts on a web page a user visits (the CVSS vector reflects the required user interaction). Exploitation is feasible when the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable, letting the attacker abuse the victim's OpenAI credentials to run unauthorized requests and consume quota or incur costs. Only deployments where a browser has network access to the Headroom proxy and an environment-stored OpenAI key are affected. No public proof-of-concept or confirmed exploitation is known, and version 0.35.0 fixes the issue.

What to do: Upgrade Headroom to version 0.35.0 or later, which adds Origin header validation. As interim mitigations, restrict network access to the Headroom proxy (e.g., bind to localhost or firewall it) so untrusted web pages and headless browsers cannot reach it, and avoid exposing the OpenAI API key through the `OPENAI_API_KEY` environment variable. Review OpenAI API usage logs and billing for unexpected or unauthenticated requests that may indicate prior abuse.